v1.4.6 LTS

1.4.6 (2026-11-09)

Bug Fixes

• api-gateway: Guard member-expression SQL eval against JS injection (#12207) (5fe01a9)
• api-gateway: Remove Transfer-Encoding header on /cubesql error responses, fix #10450 (#10455) (7c6066c)
• api-gateway: Stricter validation for member expressions (#12626) (4439321)
• Escape quote characters in SQL identifiers (#12622) (8b8d606)
• query-orchestrator: Drop touch/used keys when pre-aggregation build fails (#11314) (11a64cc)
• Update tzdb to 2026e for the Canadian DST changes (backport #12466 to v1.4) (77b02b2), closes #12471 #12431

Features

• docker: Security upgrade Node.js from 22.20.0 to 22.23.4 (02e9b89), closes #12399